UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,054
Published in 7 days
1,091
Critical in 30 days
355
Actively exploited
423

Latest vulnerabilities

40,054 vulnerabilities
  1. Medium 4.0

    CVE-2012-0485 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0112, CVE-2012-0115, CVE-2012-0119, CVE-2012-0120, and CVE-2012-0492.

    Published 18 Jan 2012 · NVD
  2. Medium 4.0

    CVE-2012-0484 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x, 5.1.x, and 5.5.x allows remote authenticated users to affect confidentiality via unknown vectors.

    Published 18 Jan 2012 · NVD
  3. Medium 4.0

    CVE-2012-0120 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0112, CVE-2012-0115, CVE-2012-0119, CVE-2012-0485, and CVE-2012-0492.

    Published 18 Jan 2012 · NVD
  4. Medium 4.0

    CVE-2012-0119 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0112, CVE-2012-0115, CVE-2012-0120, CVE-2012-0485, and CVE-2012-0492.

    Published 18 Jan 2012 · NVD
  5. Medium 4.9

    CVE-2012-0118 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect confidentiality and availability via unknown vectors, a different vulnerability than CVE-2012-0113.

    Published 18 Jan 2012 · NVD
  6. Low 3.5

    CVE-2012-0117 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0486, CVE-2012-0487, CVE-2012-0488, CVE-2012-0489, CVE-2012-0491, CVE-2012-0493, and CVE-2012-0495.

    Published 18 Jan 2012 · NVD
  7. Medium 4.9

    CVE-2012-0116 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

    Published 18 Jan 2012 · NVD
  8. Medium 4.0

    CVE-2012-0115 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0112, CVE-2012-0119, CVE-2012-0120, CVE-2012-0485, and CVE-2012-0492.

    Published 18 Jan 2012 · NVD
  9. Low 3.0

    CVE-2012-0114 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x, 5.1.x, and 5.5.x allows local users to affect confidentiality and integrity via unknown vectors.

    Published 18 Jan 2012 · NVD
  10. Medium 5.5

    CVE-2012-0113 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect confidentiality and availability via unknown vectors, a different vulnerability than CVE-2012-0118.

    Published 18 Jan 2012 · NVD
  11. Low 3.5

    CVE-2012-0112 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0115, CVE-2012-0119, CVE-2012-0120, CVE-2012-0485, and CVE-2012-0492.

    Published 18 Jan 2012 · NVD
  12. Medium 4.0

    CVE-2012-0102 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x and 5.1.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0087 and CVE-2012-0101.

    Published 18 Jan 2012 · NVD
  13. Medium 4.0

    CVE-2012-0101 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x and 5.1.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0087 and CVE-2012-0102.

    Published 18 Jan 2012 · NVD
  14. Medium 4.0

    CVE-2012-0087 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x and 5.1.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0101 and CVE-2012-0102.

    Published 18 Jan 2012 · NVD
  15. Low 1.7

    CVE-2012-0075 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x, 5.1.x, and 5.5.x allows remote authenticated users to affect integrity via unknown vectors.

    Published 18 Jan 2012 · NVD
  16. Medium 5.0

    CVE-2011-2262 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote attackers to affect availability via unknown vectors.

    Published 18 Jan 2012 · NVD
  17. Medium 5.0

    CVE-2012-0781 · PHP

    The tidy_diagnose function in PHP 5.3.8 might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that attempts to perform Tidy::diagnose operations on invalid objects, a different vulnerability than CVE-2011-4153.

    Published 18 Jan 2012 · NVD
  18. Medium 4.6

    CVE-2012-0031 · Apache HTTP Server

    scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory segment, leading to an invalid call to the free function.

    Published 18 Jan 2012 · Fixed in 2.0.65, 2.2.22 · NVD
  19. Medium 5.0

    CVE-2011-4153 · PHP

    PHP 5.3.8 does not always check the return value of the zend_strndup function, which might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that performs strndup operations on untrusted string data, as demonstrated by the define function in zend_builtin_functions.c, and unspecified functions in…

    Published 18 Jan 2012 · NVD
  20. Low 2.1

    CVE-2011-5066 · IBM WebSphere Application Server

    The SibRaRecoverableSiXaResource class in the Default Messaging Component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 does not properly handle a Service Integration Bus (SIB) dump operation involving the First Failure Data Capture (FFDC) introspection code, which allows local users to obtain sensitive information by reading the FFDC log file.

    Published 15 Jan 2012 · NVD
  21. Medium 4.3

    CVE-2011-5065 · IBM WebSphere Application Server

    Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 allows remote attackers to inject arbitrary web script or HTML via vectors related to web messaging.

    Published 15 Jan 2012 · NVD
  22. High 10.0

    CVE-2011-1377 · IBM WebSphere Application Server

    The Web Services Security component in the Web Services Feature Pack before 6.1.0.41 for IBM WebSphere Application Server (WAS) 6.1 does not properly handle the enabling of WS-Security for a JAX-WS application, which has unspecified impact and attack vectors.

    Published 15 Jan 2012 · NVD
  23. Medium 4.3

    CVE-2011-1362 · IBM WebSphere Application Server

    Cross-site scripting (XSS) vulnerability in the Installation Verification Test (IVT) application in the Install component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 and 7.0 before 7.0.0.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1308.

    Published 15 Jan 2012 · NVD
  24. Medium 4.3

    CVE-2011-5064 · Apache Tomcat

    DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184.

    Published 14 Jan 2012 · NVD
  25. Medium 4.3

    CVE-2011-5063 · Apache Tomcat

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184.

    Published 14 Jan 2012 · NVD
  26. Medium 5.0

    CVE-2011-5062 · Apache Tomcat

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184.

    Published 14 Jan 2012 · NVD
  27. Medium 5.0

    CVE-2011-1184 · Apache Tomcat

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, related to lack of checking of nonce (aka server nonce) and nc (aka…

    Published 14 Jan 2012 · NVD
  28. Medium 5.0

    CVE-2011-5057 · Apache Struts

    Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that implements an affected interface, as demonstrated by the SessionAware, RequestAware, ApplicationAware,…

    Published 8 Jan 2012 · Fixed in 2.3.3 · NVD
  29. Medium 6.8

    CVE-2012-0394 · Apache Struts

    The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself.

    Published 8 Jan 2012 · NVD
  30. Medium 6.4

    CVE-2012-0393 · Apache Struts

    The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.

    Published 8 Jan 2012 · Fixed in 2.3.1.1 · NVD
  31. Medium 6.8

    CVE-2012-0392 · Apache Struts

    The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.

    Published 8 Jan 2012 · Fixed in 2.3.1 · NVD
  32. Critical 9.8Actively exploited

    CVE-2012-0391 · Apache Struts

    The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.

    Published 8 Jan 2012 · Fixed in 2.2.3.1 · NVD
  33. Medium 5.0

    CVE-2011-4361 · MediaWiki

    MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by (1) leveraging the SpecialUpload::ajaxGetExistsWarning function, or by (2) leveraging an extension, as demonstrated by the CategoryTree, ExtTab, and InlineEditor extensions.

    Published 8 Jan 2012 · Fixed in 1.17.1 · NVD
  34. Medium 5.0

    CVE-2011-4360 · MediaWiki

    MediaWiki before 1.17.1 allows remote attackers to obtain the page titles of all restricted pages via a series of requests involving the (1) curid or (2) oldid parameter.

    Published 8 Jan 2012 · Fixed in 1.17.1 · NVD
  35. Low 2.6

    CVE-2012-0287 · WordPress

    Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the query string in a POST operation that is not properly handled by the "Duplicate comment detected" feature.

    Published 6 Jan 2012 · NVD
  36. Medium 5.0

    CVE-2012-0027 · OpenSSL

    The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client.

    Published 6 Jan 2012 · NVD
  37. Medium 5.0

    CVE-2011-4619 · OpenSSL

    The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.

    Published 6 Jan 2012 · NVD
  38. Medium 4.3

    CVE-2011-4577 · OpenSSL

    OpenSSL before 0.9.8s and 1.x before 1.0.0f, when RFC 3779 support is enabled, allows remote attackers to cause a denial of service (assertion failure) via an X.509 certificate containing certificate-extension data associated with (1) IP address blocks or (2) Autonomous System (AS) identifiers.

    Published 6 Jan 2012 · NVD
  39. Medium 5.0

    CVE-2011-4576 · OpenSSL

    The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.

    Published 6 Jan 2012 · NVD
  40. High 9.3

    CVE-2011-4109 · OpenSSL

    Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check.

    Published 6 Jan 2012 · NVD
  41. Medium 4.3

    CVE-2011-4108 · OpenSSL

    The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.

    Published 6 Jan 2012 · NVD
  42. Medium 5.0

    CVE-2011-4858 · Apache Tomcat

    Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

    Published 5 Jan 2012 · NVD
  43. Medium 5.0

    CVE-2011-4905 · Apache ActiveMQ

    Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service (file-descriptor exhaustion and broker crash or hang) by sending many openwire failover:tcp:// connection requests.

    Published 5 Jan 2012 · NVD
  44. Medium 4.3

    CVE-2011-4778 · Splunk Enterprise

    Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk 4.2.x before 4.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka SPL-44614.

    Published 3 Jan 2012 · NVD
  45. High 9.3

    CVE-2011-4644 · Splunk Enterprise

    Splunk 4.2.5 and earlier, when a Free license is selected, enables potentially undesirable functionality within an environment that intentionally does not support authentication, which allows remote attackers to (1) read arbitrary files via a management-console session that leverages the ability to create crafted data sources, or (2) execute management commands via an HTTP request.

    Published 3 Jan 2012 · NVD
  46. Medium 4.0

    CVE-2011-4643 · Splunk Enterprise

    Multiple directory traversal vulnerabilities in Splunk 4.x before 4.2.5 allow remote authenticated users to read arbitrary files via a .. (dot dot) in a URI to (1) Splunk Web or (2) the Splunkd HTTP Server, aka SPL-45243.

    Published 3 Jan 2012 · NVD
  47. Medium 4.6

    CVE-2011-4642 · Splunk Enterprise

    mappy.py in Splunk Web in Splunk 4.2.x before 4.2.5 does not properly restrict use of the mappy command to access Python classes, which allows remote authenticated administrators to execute arbitrary code by leveraging the sys module in a request to the search application, as demonstrated by a cross-site request forgery (CSRF) attack, aka SPL-45172.

    Published 3 Jan 2012 · NVD
  48. Medium 5.0

    CVE-2011-4885 · PHP

    PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

    Published 30 Dec 2011 · NVD
  49. High 7.8

    CVE-2011-4815 · Ruby

    Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.

    Published 30 Dec 2011 · NVD
  50. Medium 4.3

    CVE-2011-5027 · Zabbix

    Cross-site scripting (XSS) vulnerability in ZABBIX before 1.8.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the profiler.

    Published 29 Dec 2011 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.